DNS Email Security Checker

Domain

Extra DKIM Selectors (comma-separated)

Language

Skip MTA-STS and Security.txt checks to avoid CORS issues

Type in a domain name like google.com or microsoft.com, and click Check. Please understand that results may not be correct due to limitations in your browser or in the network from which you are testing. Scores are for indicative purposes only, they do not necessarily tell the full truth or show compliance with relevant standards.

🔐 DNSSEC

📫 MX Records

⇄ PTR / FCrDNS

🔏 DANE / TLSA

🛡 SPF

✎ DKIM

📎 DMARC

🌟 BIMI

📤 TLS-RPT

🔒 MTA-STS

🋒 CAA

📷 RPKI ROA

📌 ASPA

🌐 IPv6

📋 DNS zone hygiene

📜 Security.txt

🔍 WHOIS / RDAP

💻 Mail client autoconfiguration

📡 Connection

✎ Recommendations

Created by Per Thorsheim. Feel free to use, copy and whatever. Credit is always nice, not mandatory. Also see passwordscon.org.

Version 2026-October-13-11 — click for changelog

2026-October-13-11

ASPA works again. The ASPA tab had shown “Unavailable” for every network: RIPE Stat has no ASPA data call (its aspa endpoint answers 404 “data call does not exist”). ASPA objects are now read from the public Routinator instance run by NLnet Labs, filtered to the customer AS; only the AS numbers are sent there. An AS whose only listed provider is AS0 is shown as “declares no providers”. The tab’s badges are now translated.

2026-October-13-10

Layout. Autoconfig tab: SRV targets and the Thunderbird ISPDB host names render as inline code instead of full-width record boxes.

2026-October-13-9

Layout. CAA tab: host names in the per-host CAA table render as inline code instead of full-width record boxes.

2026-October-13-8

Layout. Zone tab: nameservers, verification tokens, the SOA names and wildcard values render as inline code instead of full-width record boxes, and the token list sits inside its collapsible block. Autoconfig tab: the ISPDB server table sits inside its collapsible block instead of leaving an empty frame above it.

2026-October-13-7

New Zone tab (informational). Hygiene of the DNS zone itself: SOA timers against RFC 1912 §2.2 (refresh, retry, expire, negative-cache TTL, retry < refresh, expire > refresh + retry, an @ in the contact), nameserver count (RFC 1034 / RFC 2182) with the AS diversity from the RPKI data, a CNAME at the apex (RFC 2181 §10.1), the size of the apex TXT answer against the 1232-byte EDNS buffer and the verification tokens that make it up, and wildcard A/AAAA/CNAME/MX/TXT records — a wildcard TXT answers _dmarc, _mta-sts and _smtp._tls discovery for every non-existent subdomain. Timer findings are notes, since the large anycast providers set them deliberately. Never scored.
CAA on the hosts that present certificates. The CAA tab now also evaluates CAA the way a CA would for every MX host and for mta-sts.<domain> (own record, else the nearest parent per RFC 8659 §3) and lists the authorized CAs per host. Informational — the CAA rating is unchanged, since MX hosts usually sit in the mail provider’s zone.
Fix: the Autoconfig tab threw while rendering a domain listed in the Thunderbird ISPDB (gmail.com, posteo.de), which left the Overview spinning with no grade. The server table’s collapsible block appended its content before it existed; the test DOM stub now rejects that like a browser does.

2026-October-13-6

New Autoconfig tab (informational). Mail client autoconfiguration as seen from DNS and the Thunderbird ISPDB: the RFC 6186 / RFC 8314 / RFC 8620 SRV records (_submission, _submissions, _imap, _imaps, _pop3, _pop3s, _jmap) with target resolution, explicit “not offered” targets, cleartext-only services, CNAME or unresolvable targets, non-standard ports and the DNSSEC status of the answers; Microsoft Autodiscover (SRV and autodiscover.<domain>, Microsoft 365 recognised); the Mozilla autoconfig.<domain> host and the central ISPDB entry with its configured servers. Never scored.
Registrar locks. The WHOIS tab now distinguishes registrar locks (client*Prohibited) from registry locks (server*Prohibited), reports a partial lock set, a transfer in progress (pendingTransfer) and registries that publish no status codes at all (.no, .de), and shows the registry’s DNSSEC flag with a cross-check against the DNSSEC tab. Excellent now requires all three locks; a lone clientTransferProhibited rates good.

2026-October-13-5

MX hygiene. The MX tab now checks what the MX set actually points at: an MX target that is a CNAME (RFC 5321 §5.1) or an IP address, a host with no A/AAAA record, duplicate hosts, a single host (no fallback), and — from the RPKI data — every MX host sitting in one AS. A domain whose MX hosts cannot all be used rates warning; none usable rates fail.
HELO/EHLO SPF. Each MX host’s own SPF record (RFC 7208 §2.3) is probed and listed in a sub-table in the SPF tab. Informational.
SPF depth. Permerror conditions a receiver would hit are now reported as fail: an unknown mechanism or an unparsable term, a duplicate redirect=/exp=, an include: whose target has no SPF record or several, an mx: with more than ten hosts, and more than two void lookups (NXDOMAIN or empty answers) across the include tree (RFC 7208 §4.6.4). A record over ~450 bytes is flagged (§3.4). Grades can move for records that are silently broken today.

2026-October-13-4

DANE fix (grades move up). Since 2026-October-13-1 a TLSA record returned in the multi-line presentation form with parentheses — which Cloudflare’s resolver uses for every SHA-256/SHA-512 digest — was flagged as malformed, so domains with correct DANE (mailbox.org, proton.me, posteo.de …) rated warning or fail. The parentheses are now stripped before the digest is checked.
Cross-protocol coherence. A new section at the top of the Fixes tab reports findings that only exist between checks: TLS-RPT published with neither an MTA-STS policy nor DANE to report on; MTA-STS in testing mode without TLS-RPT (the test is blind); a BIMI record while DMARC is not at p=quarantine/reject with pct=100 and sp not none (the logo will never show); DMARC enforcing with no SPF record at all; DMARC/TLS-RPT report destinations (mailto:) whose host has neither MX nor address record, or a null MX, so reports are undeliverable; and a positive note when both DANE and an enforcing MTA-STS policy are in place. Display-only — it never moves the grade or a tab dot.

2026-October-13-3

DNSSEC depth. The DNSSEC tab now verifies the chain of trust for the scanned domain’s zone, not just the DNSKEY set: the DS records at the parent are fetched and matched against the published keys by key tag and algorithm (no DS = an “island of security” validators ignore, warning; no DS matching any key = broken chain, fail; a DS left from a previous key = warning; a SHA-1 digest = warning); the registry’s DS data from RDAP is compared with DNS (a difference means a stalled or half-done rollover); the signature lifetimes of the DNSKEY and SOA RRSIGs are read (expired = fail, less than 20% of the validity window left = warning — relative, since re-signing cadences range from two days to months); NSEC3 parameters are checked against RFC 9276 (more than 100 iterations = warning, any iterations or salt = note, opt-out = note); and RSA key sizes below 2048 bits are flagged (RFC 8624). Key tags and sizes are shown next to each algorithm. Grades can move for zones with a broken or stale delegation.
The RDAP document is fetched once per scan and shared between the DNSSEC and WHOIS checks.

2026-October-13-2

DKIM wildcard control probe. A random, nonsense selector is probed alongside the known ones. If it answers with a DKIM record, the zone has a wildcard under _domainkey and every probe would otherwise “find” a key: the wildcard is now shown as its own entry, selectors returning the identical record are no longer counted as discoveries (an explicit record that differs is still genuine), and the check is capped at warning. brevo.com, which publishes a revoked wildcard, used to list ~90 “revoked” selectors.
DKIM: a key flagged t=y (testing) caps the rating at good; an Ed25519 key whose p= is not exactly 32 bytes rates fail (RFC 8463); obsolete DomainKeys (_domainkey) and ADSP (_adsp._domainkey, RFC 5617) policy records are reported as removable — informational only.

2026-October-13-1

Grades can move. A full audit of the check logic found a number of ratings that were wrong in both directions; the fixes below change what some domains score.
DKIM: a revoked selector (empty p=) no longer fails the whole check — revoking old keys is correct practice, so only live keys rate. A domain whose only discovered keys are revoked rates warning.
DANE: null MX (RFC 7505) is “not applicable” rather than fail; PKIX usages 0/1 rate warning (RFC 7672 §3.1.3); malformed TLSA records (bad field values, wrong digest length) are flagged; partial coverage now rates good as intended; excellent additionally requires the MX set itself to be DNSSEC-validated.
SPF: a redirect= whose target cannot be fetched is reported as an error instead of silently rating excellent; redirect= is ignored when the record has an all mechanism (RFC 7208 §6.1); mechanisms and findings listed before the redirect are kept; macro targets are no longer queried literally.
DMARC: a subdomain without a record of its own is graded on the policy it inherits from the organizational domain (sp=, else p=, found by the DMARCbis tree walk) instead of fail; whitespace around = is accepted; adkim/aspf are case-insensitive; sp=none / sp=quarantine on an organizational domain now lower the rating; an invalid pct= is flagged.
DNS failures: SERVFAIL and other resolver errors are reported as “DNS lookup failed” instead of “not signed”, “no record” or “no DKIM records” — across DNSSEC, MX, DANE, SPF, DKIM, DMARC, TLS-RPT, MTA-STS, CAA and BIMI. A broken DNSSEC chain is the most urgent finding there is and used to read as the mildest.
TLS-RPT: an https: endpoint no longer erases a preceding bad-URI warning.
CAA: an iodef tag alone no longer rates excellent (it restricts no CA); a subdomain with no CAA inherits its parent’s records (RFC 8659 §3); issuemail (S/MIME, RFC 9495) is reported separately from TLS issuers.
MTA-STS: redirects are refused (RFC 8461 §3.3); a body that is not a policy (an HTML page, say) is reported as such; max_age is required and bounded; fetch errors are translated instead of English-only.
BIMI: an empty l= is the valid opt-out; more than one record counts as none; non-https URLs are flagged. security.txt: HTML catch-all pages no longer win (the file must be text/plain); a __proto__: line no longer crashes the check; the panel rating matches its worst issue; duplicate Expires flagged. WHOIS: registrar/registry locks rate excellent, hold/pending-delete and imminent expiry rate warning, subdomains query the registrable domain, dates follow the UI language.
Overview: the rating next to each score bar is translated (it was English in every language); one scoring table now drives the grade, the Fixes tab and the scoring explanation, which also notes how a skipped check is renormalised.
One scan at a time. Pressing Enter or using Back/Forward while a scan was running started a second scan on top of the first; the two then fought over the DNS cache, the statistics and the results, and the URL could end up naming a different domain from the one on screen. A scan now runs alone, and a scan abandoned by going Back drops its results instead of painting them over the start page.
Language switch mid-scan no longer repaints the previous domain’s results over the spinners; the running scan renders in the new language when it finishes.
History: Back/Forward and opening a shared link no longer push a duplicate entry (which wiped the forward history).
Resolver fallback: when cloudflare-dns.com is unreachable or blocked, the lookup is retried once via dns.google — corporate and national filters of Cloudflare’s resolver no longer make every check fail. Counted in the statistics panel.
Faster: the RIPE Stat caches now share in-flight lookups (two hosts on one address, or the Connection tab and the RPKI tab, used to fetch the same data twice); each address is looked up once per scan; holder names and ASPA records are fetched in one stage; the DMARCbis tree walk issues its lookups in parallel instead of up to seven in a row; a prefix with several origin ASes is validated for every origin and rated on the worst.
Accessibility: a live region announces when a scan starts and finishes (with the grade); the coloured tab dots carry their rating as text (hover and screen reader); the settings button is labelled and announces its menu state; the scoring explanation is a proper dialog that moves focus in and back out; following a link in the Fixes tab keeps keyboard focus; the Overview, Connection and Fixes tab labels, the tab-list and help-button labels, the ROA labels in the Connection tab and the WHOIS dates are translated.
Robustness: Firefox and Safari network errors are translated like Chrome’s; non-JSON responses are normalised; DNSKEY records carrying the REVOKE flag or too few fields no longer break the DNSSEC check; a late lookup failure can no longer evict the next scan’s cached query; every MX-host fan-out shares one parser, so null MX is handled identically everywhere; blocked localStorage (private mode, some embedded contexts) no longer stops the page from loading; a stored language name like constructor cannot slip through; a transient RIPE Stat failure is no longer remembered for the whole session; the WARP detection in the ISP BGP test needs a positive warp=on line rather than the absence of warp=off; IPv6 can rate excellent for a subdomain without name servers of its own.
Tests: new tests/ directory — a Node harness that loads index.html with canned DNS answers (node tests/run.js), the static consistency checks (node tests/static.js) and a live smoke run (node tests/live.js).

2026-August-31-2

When the “Is your ISP BGP-safe?” test finds an ISP that accepts RPKI-invalid routes, a new “Report this result by email” link prefills an email to the author with the verdict, AS number, ISP name and date — it opens in the visitor’s own mail client, so nothing is ever sent automatically and everything can be edited first

2026-August-31-1

New Connection tab testing the network you are browsing from — not the scanned domain: whether your DNS resolver validates DNSSEC (a test name with a deliberately broken signature must fail to load; method and domains from Matthäus Wander’s DNSSEC Resolver Test), your public IPv4 and IPv6 addresses via icanhazip.com — each with ASN, holder, prefix and RPKI ROA status — and the “Is your ISP BGP-safe?” test, which moved here from the RPKI tab. Runs once per page session on the first scan, is reused by later scans, and never affects any rating, score or grade

2026-August-19-1

A domain that does not exist (NXDOMAIN) no longer triggers a scan: a single SOA lookup gates the whole run, and a “Domain does not exist. Try another one.” message is shown instead — dismissed with OK, Escape or a click outside. Previous results on screen stay untouched, and the dead domain is not pushed into the shareable URL

2026-August-17-3

Jan Sandtrø's name in the acknowledgements now links to sandtro.no

2026-August-17-2

New in the RPKI tab: “Is your ISP BGP-safe?” — tests whether the network you are browsing from drops RPKI-invalid BGP routes, using the test method behind Cloudflare’s isbgpsafeyet.com (MIT-licensed). Two test beacons are fetched — one covered by a valid ROA, one deliberately invalid; if the invalid one loads within two seconds, your ISP does not filter hijacked routes. Detects Cloudflare WARP, which would mask the ISP. Runs once per page session on the first scan; later scans reuse the result. It measures your connection, not the scanned domain, and never affects any rating, score or grade

2026-August-17-1

Grades can move in this release. DNSSEC is now rated on the weakest algorithm a zone publishes rather than the strongest. A zone is signed with every algorithm in its DNSKEY set and a validator may rely on any one of them, so a zone offering both ECDSA P-256 and RSA/SHA-1 is only as strong as the RSA/SHA-1 signatures. Every algorithm is still listed, with the deciding one marked and explained. This can lower both the DNSSEC bar and the MX bar (which inherits each MX host’s DNSSEC result) for zones mid-rollover; single-algorithm zones are unaffected
A hung request can no longer strand a scan. Every outbound request now carries a deadline — previously only the two HTTPS policy fetches did, so one stalled DNS, RDAP or RIPE Stat request left the spinner running and the Check button disabled with no error and no way out but a reload
BIMI is visible again in the Overview bars and the Fixes tab, and its panel badge no longer reads the raw string RATING_NONE. It stays deliberately unscored — now with a proper “Not scored” label in all four languages
SPF: a/24 and mx//64 are parsed correctly. The /24 is a CIDR suffix, not a hostname — the checker had been treating it as a domain called 24 and looking it up
DKIM: a selector answering with two TXT records no longer has them glued into one unparsable string, and a wildcard v=spf1 record under _domainkey is no longer mistaken for a key
SPF and DMARC propagation warnings no longer fire on records that match — the two resolvers’ answers are now compared as sets rather than by first-record string equality
Roughly a third fewer DNS queries per scan: identical lookups are answered once and shared, and every fan-out is bounded rather than opening dozens of connections at once. The security.txt check tries its four candidate URLs concurrently instead of one after another
Theme now persists across reloads, follows your system preference on first visit, and no longer flashes dark before switching to light
The domain field keeps its example.com hint, which the translation pass had been overwriting with the field label
PTR results are labelled in words instead of a bare tick or warning glyph; the Back button now works; the copy-link button degrades gracefully when the clipboard is unavailable
Tab bar is now a proper ARIA tablist with arrow-key navigation and a visible focus ring; validation errors are announced to screen readers
Every remaining hardcoded English string in the check results is translated, including the NXDOMAIN, no-MX and no-DKIM messages. translations/no.js now exists so Norwegian can be contributed like any other language

2026-August-13-4

IPv6 tab: added the Netherlands — IPv6 has been a comply-or-explain standard since 2010, and a government-wide agreement requires public bodies to be reachable over IPv6 for websites and e-mail since 31 December 2021
IPv6 tab: added Germany (Netzstrategie 2030, IT-Planungsrat decision 2019)
Corrected the EU entry — the NIS2 Directive does not require IPv6. The row now points at the ISA² IPv6 Framework for European Governments, which is guidance rather than a mandate
Checked Sweden and Denmark: neither has a binding requirement. Sweden’s PTS recommends IPv6 and proposed a requirement in 2022 that was never enacted; Denmark leaves IPv6 out of its technical minimum requirements for state authorities. Both are now named explicitly so the omission is not mistaken for an oversight

2026-August-13-3

Removed the hardcoded “Provider Reference” table from the DKIM tab — the probed-selector list already groups every selector under its provider, so the two overlapped

2026-August-13-2

Jan Sandtrø added to the acknowledgements — improving the MTA-STS and Security.txt checks, plus many other updates

2026-August-13-1

DKIM selector list audited against live DNS across 274 domains and against provider documentation. Added zendesk1/zendesk2, mte1/mte2 (current Mandrill CNAME pair), mailjet, cm, salesforce/sfdc, s3/s4, kl/kl2, m2, mlsend/mlsend2, resend, mailgun, scph0325
Removed selectors with no evidence of use and no documented basis: pp2021–pp2024, klaviyo, tuta01/tuta02, mcsv, sendgrid, zmail, sig2, hs3, sp2, ac, iterable, sendinblue/brevo, infomaniak, ovh, hetzner
Corrected provider attributions: m1 is Marketo's documented default (not generic), pic/krs are Mailgun, key1/key2 are Tucows OpenSRS (Squarespace, Wix), mc1/mc2 were SendGrid rather than Mimecast, and scph* is SparkPost rather than Mailchimp
Domeneshop's dsYYYYMM rotation window is now generated from the current date instead of hardcoded — the checked-in range had already expired in June 2026
The probed-selector list at the bottom of the DKIM tab now shows each selector grouped under its provider, instead of hiding the provider in a tooltip
New DKIM2 section in the DKIM tab covering the IETF successor standard, with links to the working group drafts
Fixed <domain> placeholders rendering as raw HTML entities in the Spanish and French explanation text (the same bug fixed earlier for English and Norwegian)

2026-July-27-5

Language picker is now a row of inline buttons instead of a dropdown — switching language is one click rather than two
Active language is marked with aria-pressed, so screen readers announce the selection and the highlight is driven straight off that attribute

2026-July-27-4

Esperanto, Arabic and Hindi removed as UI languages — the tool now ships in English, Norwegian, Spanish and French
A stored language preference naming a removed language now falls back to English and is rewritten, so the language selector and the active language can never disagree
No RTL language currently ships, so text direction is fixed to ltr. The stylesheet keeps its CSS logical properties, so re-adding an RTL language needs only that one line changed

2026-July-27-3

Translation debt cleared: every UI language is now complete. Norwegian gained 13 keys; Esperanto, Spanish, French, Arabic and Hindi gained 34 each — the whole IPv6 tab (including the mandatory-requirements table and its explanation), SPF recursive lookup counts, SPF legacy type-99 detection, SPF/DMARC resolver propagation warnings, DKIM key rotation note, CAA issuemail note, nameserver ASN diversity and the Overview provider chips
No language falls back to English any more — all 7 languages cover all static, dynamic and explanation strings
Contributor files translations/*.js brought fully in sync with index.html

2026-July-27-2

Arabic: fixed a typo in the Security.txt explanation (“يُوثَد” → “يُوثَق”)
Translation files translations/ar.js, fr.js and hi.js brought in sync with index.html — DMARCbis keys backfilled, plus the previously missing PANEL_IPV6 and SELECTOR_HELP keys

2026-July-27-1

DMARC: new “DMARCbis conformance” section checking the record against RFC 9989 / 9990 / 9991 (May 2026), which obsolete RFC 7489 and RFC 9091. Informational — the grade is unchanged
DMARCbis: DNS tree walk (RFC 9989 §4.10) replaces the Public Suffix List — shows every _dmarc. lookup a receiver makes, which record actually applies, and the resulting organizational domain
DMARCbis: external reporting authorization (RFC 9990 §4, RFC 9991 §5) — verifies that third-party rua=/ruf= destinations publish <domain>._report._dmarc.<destination>, and flags destination overrides that point at a different host
DMARCbis: tag conformance against the RFC 9989 §9.3 registry — pct=, rf= and ri= flagged as historic, new t= (test mode), np= and psd= tags checked, plus v= ordering, duplicate tags, fo= syntax, obsolete !size URI suffixes and unregistered tags
DMARCbis: suggested conformant record generated for each domain, with pct=0 migrated to t=y
DMARC explanation updated for the new RFCs; aggregate reports corrected from “JSON” to XML. Translated into all seven languages

2026-April-30-2

Mobile fix: domain and DKIM selector inputs now fill the full card width (flex column mode was expanding items to fill height instead of width, leaving a large blank gap)
Mobile fix: “MTA-STS” and “TLS-RPT” score bar labels no longer wrap to two lines (white-space:nowrap added; 50px width override removed)

2026-April-30-1

Mobile layout improvements: reduced padding on small screens, gear button no longer overlaps the title on iPhone
iOS safe-area support (viewport-fit=cover + env(safe-area-inset-*)) — content clears notch and home indicator bar
New 480px breakpoint for compact phones (iPhone SE): tighter padding, Security.txt fields stack vertically, DKIM provider table scrolls horizontally if needed
IPv6 requirements table: country names now wrap correctly instead of overflowing on narrow screens

2026-April-27-2

SPF: recursive include-chain lookup counting — follows all include: and redirect= chains to count total DNS lookups across the full evaluation tree (RFC 7208 §4.6.4 limit of 10)
SPF: detects legacy DNS type-99 SPF records (deprecated since RFC 7208; should be removed)
SPF + DMARC: cross-checks records between Cloudflare and Google DNS resolvers — warns on propagation mismatch
DKIM: best-practice reminder to rotate keys at least annually
CAA: issuemail tag (RFC 8657) now parsed, linkified, and included in authorized-CA and DNSSEC checks
RPKI: nameserver ASN diversity section — warns when all NS hosts share a single ASN
Overview: detected email infrastructure chips (provider names derived from DKIM selectors, SPF includes, and MX hostnames)

2026-April-27-1

DKIM selector help popover: a ? button next to the “Extra DKIM Selectors” label explains what a selector is, how to find it in email headers, and why to add custom ones here
Translations in all 7 languages (EN, NO, EO, ES, FR, AR, HI)
Popover closes on click-outside, Escape, or language switch

2026-April-17-1

New IPv6 tab: checks AAAA records for the domain, all MX hosts, and all NS hosts — informational only (not scored)
MX tab: each MX host row now shows an IPv6 availability badge
IPv6 tab includes mandatory government requirements (Norway §12, USA, EU, India, China) and country regulation links
English and Norwegian translations added; other languages fall back to English

2026-April-16-2

Acknowledgements fireworks now trigger on click instead of hover
Acknowledgements table: Name and Contribution cells left-aligned

2026-April-16-1

Arabic (‎العربية) added as a UI language — full RTL layout support via CSS logical properties; all static strings, dynamic strings, and explanation texts translated
Hindi (हिन्दी) added as a UI language — full translation of all static strings, dynamic strings, and explanation texts across all 17 tabs

2026-April-14-9

Español (es) added as a UI language — full translation of all static strings, dynamic strings, and explanation texts across all 17 tabs

2026-April-14-8

“Statistics” collapsible panel on Overview tab: total scan time, Cloudflare DoH query count, RIPE Stat API calls (with cache hits), HTTP fetches, DKIM selectors tested/found, IPs resolved, and per-check timing bars

2026-April-14-7

BIMI tab dot no longer coloured — BIMI is not scored and not shown in score bars or Fixes tab
BIMI explanation opens with an editorial note on its lack of security value

2026-April-14-6

Skip CORS option consolidated to a single checkbox: “Skip MTA-STS and Security.txt checks to avoid CORS issues”

2026-April-14-5

Esperanto (eo) added as a UI language — full translation of all static strings, dynamic strings, and explanation texts across all 17 tabs

2026-April-14-4

Acknowledgements section in footer: click to expand a table of contributors; hover triggers a 5-second fireworks display

2026-April-14-3

Shareable link: after a scan, a “Copy link” button appears; the URL encodes domain, custom selectors, and skip preferences so the same scan can be re-run from the link
Auto-run on load when ?domain= URL parameter is present

2026-April-14-2

Skip checkboxes for MTA-STS and Security.txt on the input page to avoid CORS issues; preferences persisted in localStorage
Skipped checks show a grey "Skipped" badge and panel message; MTA-STS score weight excluded and normalised when skipped; skipped checks excluded from Fixes tab

2026-April-14-1

MTA-STS & Security.txt: CORS-blocked fetches now show a bold note explaining that CORS restrictions indicate stronger-than-normal server security
DKIM: no-selectors-found result now shows a bold note clarifying that DKIM may still be configured with a non-standard selector name
ASPA explanation: added note that RFC 9582 is a proposed standard with very limited deployment; absence of ASPA does not affect scoring; encourages asking providers about deployment plans
WHOIS explanation: added note that recently created domains are an indicator of reduced trust and elevated risk of malware/phishing use
DNSSEC algorithm details: each algorithm now shows a coloured rating badge (Excellent / Good / Warning / Fail)
Light theme set as default (previously followed OS preference)

2026-April-13-4

Overview placeholder text updated with usage guidance and disclaimer about result accuracy

2026-April-13-3

RPKI/ASPA: in-memory session caching for all RIPE Stat API calls (IP→ROA, ASN→ASPA, ASN→holder name); re-checking multiple domains that share infrastructure no longer re-fetches cached results
Extracted fetchASNHolder(asn) helper; eliminates the two duplicated inline AS-overview fetch blocks

2026-April-13-2

Light/dark theme toggle replaced with a settings menu (⚙) in the upper right
Settings menu: theme toggle + new “Scoring System” option showing the weighted grade calculation, rating points, and grade thresholds

2026-April-13-1

ASPA: moved out of RPKI tab into its own dedicated tab (17th tab)
RPKI tab: now shows only ROA/prefix validation; ASPA section removed
“Recs” tab renamed to “Fixes”
Overview score bars and Fixes tab now include ASPA as an informational entry

2026-April-08-5

Security.txt: also checks https://www.<domain> when bare domain fetch fails (many orgs host security.txt on www subdomain)
Security.txt: when fetch fails due to CORS, shows informative message and clickable links to all checked URLs for manual verification

2026-April-08-4

Footer version line now reads "click for changelog" to hint the feature is interactive

2026-April-08-3

Changelog added to footer — version string expands to full release history

2026-April-08-2

DKIM: raw TXT record now shown in key details

2026-April-08-1

DKIM: full key record tag analysis — h= (hash algorithms, SHA-1 deprecation warning per RFC 8301), s= (service type), t= (flags), v= (version), n= (notes)
DKIM: auto-probe selector list expanded to ~85 selectors; added Apple iCloud, Mandrill, Tuta, Constant Contact, Marketo, Salesforce Pardot, ActiveCampaign, Intercom, Customer.io, Iterable, Sailthru, MailerLite, Infomaniak, OVH, Hetzner, Domeneshop (ds+YYYYMM monthly rotation)
DNS configuration examples added to DMARC, TLS-RPT, MTA-STS, CAA, and Security.txt explanation sections
CAA: issuemail tag guidance (RFC 9495, S/MIME certificates) and BIMI VMC certificate notes added
Security.txt: example file and link to securitytxt.org generator added
Fixed rendering bug: <domain> placeholders were displayed as raw HTML entities in explanation sections

2026-March-13-1

Initial public release

Name	Contribution
Tor Vigesdal	Suggestions for easier translations & skipping tests blocked by CORS
Dag Øien	Convinced me to give a 💩 about BIMI
Jan Sandtrø	Improving mta-sts & Security.txt checks, + many other updates

DNS Email Security Checker

Overall Score